Skip to content

Commit

Permalink
fixed fuzzing crash in setScopeInfo() [skip ci]
Browse files Browse the repository at this point in the history 
/home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2555:31: runtime error: member call on null pointer of type 'Token'
    #0 0x62508946d2b4 in (anonymous namespace)::setScopeInfo(Token*, (anonymous namespace)::ScopeInfo3**, bool) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2555:31
    #1 0x6250894629b6 in Tokenizer::simplifyUsing() /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2903:17
    #2 0x62508947d6c5 in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:5674:12
    #3 0x625089476021 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:3374:14
    #4 0x625089f54ca1 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:937:32
    #5 0x625089f44014 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:564:12
    #6 0x62508904544b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
    #7 0x625088f7f97b in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:279:32
    #8 0x625088f7e74d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:218:12
    #9 0x625088f7d68a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:204:21
    #10 0x62508a68c327 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
    #11 0x761e7f21eccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #12 0x761e7f21ed89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #13 0x625088db79f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6b9f4) (BuildId: c4d5a113239183a4005a1a2662be02131ded6024)

fixed fuzzing crash in `setScopeInfo()`

/home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2548:51: runtime error: member call on null pointer of type 'Token'
    #0 0x5d3809ee7015 in (anonymous namespace)::setScopeInfo(Token*, (anonymous namespace)::ScopeInfo3**, bool) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2548:51
    #1 0x5d3809edc9b6 in Tokenizer::simplifyUsing() /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2903:17
    #2 0x5d3809ef76a5 in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:5674:12
    #3 0x5d3809ef0001 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:3374:14
    #4 0x5d380a9cec81 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:937:32
    #5 0x5d380a9bdff4 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:564:12
    #6 0x5d3809abf44b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
    #7 0x5d38099f997b in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:279:32
    #8 0x5d38099f874d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:218:12
    #9 0x5d38099f768a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:204:21
    #10 0x5d380b106307 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
    #11 0x7fe30271fccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #12 0x7fe30271fd89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #13 0x5d38098319f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6b9f4) (BuildId: 0e9bdb7f1c43e507f2fcb4d97a15b0f529a13c20)

fixed fuzzing crash in `setScopeInfo()`

/home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2540:44: runtime error: member call on null pointer of type 'Token'
    #0 0x5ec589e5f40f in (anonymous namespace)::setScopeInfo(Token*, (anonymous namespace)::ScopeInfo3**, bool) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2540:44
    #1 0x5ec589e5505d in Tokenizer::simplifyUsing() /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:2900:17
    #2 0x5ec589e6fd25 in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:5671:12
    #3 0x5ec589e68681 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:3371:14
    #4 0x5ec58a9497ca in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:925:32
    #5 0x5ec58a938a97 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:556:12
    #6 0x5ec589a36f2b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
    #7 0x5ec5899718dc in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:277:32
    #8 0x5ec58997073d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:216:12
    #9 0x5ec58996f67a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:202:21
    #10 0x5ec58b0802b7 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
    #11 0x79b410843ccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #12 0x79b410843d89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #13 0x5ec5897aa9f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6e9f4) (BuildId: 5c2986a23a9dee600c328566a7967a7eba8652c9)

Co-authored-by: chrchr-github <[email protected]>
  • Loading branch information
@firewave @chrchr-github
firewave and chrchr-github committed Apr 2, 2024
1 parent 5c5d6a8 commit 0d0deb2
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
9 changes: 4 additions & 5 deletions lib/tokenize.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1253,10 +1253,9 @@ void Tokenizer::simplifyTypedefCpp()
Token *namespaceEnd = nullptr;

// check for invalid input
if (!tokOffset)
if (!tokOffset || tokOffset->isControlFlowKeyword())
syntaxError(tok);


if (tokOffset->str() == "::") {
typeStart = tokOffset;
tokOffset = tokOffset->next();
Expand Down Expand Up @@ -2536,22 +2535,22 @@ namespace {
tok1 = tok1->previous();
if (tok1->previous() && (tok1->strAt(-1) == ")" || tok->strAt(-1) == "}")) {
tok1 = tok1->linkAt(-1);
if (Token::Match(tok1->previous(), "throw|noexcept (")) {
if (tok1 && Token::Match(tok1->previous(), "throw|noexcept (")) {
tok1 = tok1->previous();
while (Token::Match(tok1->previous(), "const|volatile|final|override|&|&&|noexcept"))
tok1 = tok1->previous();
if (tok1->strAt(-1) != ")")
return;
tok1 = tok1->linkAt(-1);
} else {
while (Token::Match(tok1->tokAt(-2), ":|, %name%")) {
while (tok1 && Token::Match(tok1->tokAt(-2), ":|, %name%")) {
tok1 = tok1->tokAt(-2);
if (tok1->strAt(-1) != ")" && tok1->strAt(-1) != "}")
return;
tok1 = tok1->linkAt(-1);
}
}
if (tok1->strAt(-1) == ">")
if (tok1 && tok1->strAt(-1) == ">")
tok1 = tok1->previous()->findOpeningBracket();
if (tok1 && (Token::Match(tok1->tokAt(-3), "%name% :: %name%") ||
Token::Match(tok1->tokAt(-4), "%name% :: ~ %name%"))) {
Expand Down
1 change: 1 addition & 0 deletions test/cli/fuzz-crash/crash-5db88ae1610f5a9782ea78af206f9cd87b6708dd
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{for(typedef;);}

0 comments on commit 0d0deb2

Please sign in to comment.